E524 [12.x] Update phpunit version constraints to address CVE by PerryvanderMeer · Pull Request #58526 · laravel/framework · GitHub
[go: up one dir, main page]
Skip to content

[12.x] Update phpunit version constraints to address CVE #58526

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
PerryvanderMeer wants to merge 1 commit into
base: 12.x
Choose a base branch
from
Open

[12.x] Update phpunit version constraints to address CVE #58526

PerryvanderMeer wants to merge 1 commit into from
+1 −1

Conversation

@PerryvanderMeer
Copy link
Contributor
@PerryvanderMeer PerryvanderMeer commented Jan 28, 2026

@PerryvanderMeer PerryvanderMeer changed the title Update phpunit version constraints to address CVE [12.x] Update phpunit version constraints to address CVE Jan 28, 2026
GrahamCampbell
GrahamCampbell requested changes Jan 28, 2026
View reviewed changes
Copy link
Collaborator
@GrahamCampbell GrahamCampbell left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is not necessary. The vulnerability does not affect our code-paths in CI and we do want to test the earlier versions of PHPUnit for compatibility.

@GrahamCampbell
Copy link
Collaborator
GrahamCampbell commented Jan 28, 2026

@crynobone is probably the best person to decide what to do with this (aka whether we would rather stop testing PHPUnit 12.2 and only test the latest version of 12.x).

@crynobone
Copy link
Member
crynobone commented Jan 28, 2026

This is unnecessary

CleanShot 2026-01-28 at 18 50 50

@crynobone
Copy link
Member
crynobone commented Jan 28, 2026 •
edited
Loading

Also, latest Composer doesn't install package with known vulnerability unless explicitly stated via composer.json audit configuration. e.g:

    "config": {
        "audit": {
            "block-insecure": false
        }
    }

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@GrahamCampbell GrahamCampbell GrahamCampbell requested changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@PerryvanderMeer @GrahamCampbell @crynobone
0